CVE-2023-20130: cisco cisco prime infrastructure Path Traversal: 'dir/../../filename'

Vulnerability summary

CVE-2023-20130 is a medium (CVSS 6.5) Path Traversal: 'dir/../../filename' vulnerability in cisco cisco prime infrastructure. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.7% of scored vulnerabilities.

Timeline

1. 05-04-2023
   PublishedVulnerability first disclosed.
2. 25-10-2024
   Last modifiedVulnerability information updated.

Description

Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see the Details section of this advisory.

• CWE-27Path Traversal: 'dir/../../filename'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.
• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.